UEBA for Small Teams

Advice in this field assumes a team that can tune models and review a queue. Many organisations have one person doing security among other duties, and the same exposure.

What does not transfer

Peer grouping. With forty employees, groups are too small for statistical comparison. Everyone is an outlier.

Learned models. Insufficient data to train and nobody to maintain them.

A daily queue. Nobody has capacity to review anything daily.

A platform. The licence and the operating cost exceed what is available, and an unmaintained deployment is worse than none.

What does transfer, cheaply

Service account baselining, done by hand. A small organisation has perhaps twenty service accounts. Document what each does, which hosts it touches, on what schedule. A monthly check against that document is behavioural analytics without a product, and it covers the highest-precision detections in the field.

High-precision rules, no baseline required. These have near-zero false positive rates and are available in most platforms already:

Service account interactive logon. External mail forwarding rule creation. Impossible travel. Authentication from a country you do not operate in. Administrative group membership change. Bulk export from your main data system. Dormant account reactivation.

That list catches a substantial share of realistic incidents and needs no modelling at all.

Cloud audit log review, monthly. Your identity provider and file platform already record sign-ins, sharing changes, consent grants and administrative actions. An hour a month reading them is more than most small organisations do.

Access reduction. More effective than any detection, and easier at small scale because the systems are few and the decisions are quick.

Entity resolution by hand. With eighty accounts, mapping them to people is an afternoon, and it makes everything else work.

The one-page programme

For an organisation without a detection function:

Enable the seven rules above. Document what each service account should do. Review cloud audit logs monthly, looking at sharing changes and administrative actions. Check who can reach your most sensitive system quarterly. Run a departure checklist. Confirm every account maps to a person or a documented purpose.

That is achievable in a few days of setup and an hour a month afterwards, and it covers more than many enterprise deployments do in their first year.

What small scale makes easier

Worth stating, because the disadvantages are usually all that gets mentioned.

You know your people. Anomalies that would need investigation in a large organisation are resolved with one message.

Your environment is comprehensible. One person can hold the whole estate in their head, which no enterprise analyst can.

Change is visible. New systems, new access and new joiners are known events rather than log entries.

Service accounts are enumerable. The highest-value entity population is small enough to document by hand.

When to buy something

When you have someone who will operate it, with hours allocated. Not before.

A UEBA product with nobody reviewing output produces licence cost, an unreviewed log and a false belief that the problem is handled. That last one is the real damage: it displaces the cheap measures that would have worked.

The managed service question

Frequently the right answer at this scale, with two conditions.

Ask what they will actually review and at what volume. A service that forwards raw alerts has moved the queue, not staffed it.

Ask who does entity resolution and tuning. If the answer is you, the service is not solving the binding constraint.

A monthly hour

The whole programme for a small organisation, in a repeatable checklist that fits in an hour.

Identity review, ten minutes. New accounts since last month. Accounts not used in ninety days. Any account that cannot be tied to a person or a documented purpose.

Privileged access, ten minutes. Who is in administrative groups. Any change since last month, and whether it was expected.

Cloud audit sample, twenty minutes. Sharing changes on your file platform, consent grants, administrative actions, sign-ins from unfamiliar countries.

Service account check, ten minutes. Compare against your documented list of what each should do. Anything running at a new time, from a new host, or against a new system.

Rule health, five minutes. Confirm the high-precision rules are still enabled and still firing occasionally. A rule that has produced nothing for six months may be broken.

Note anything odd, five minutes. A written record is what makes patterns visible across months.

Common false positives

At small scale the causes are usually knowable within a message:

A colleague covering for someone on leave.

A new tool adopted by one person or the whole company.

A contractor or consultant with legitimately unusual access.

Travel, producing foreign sign-ins.

A personal device added to the account.

Automation someone set up — a mail rule, an integration, a script — without telling anyone.

The advantage of small scale is that every one of these is resolved by asking, which is why the checklist above is worth more than a product.

Blind spots and assumptions

That small means low risk. A small organisation can lose its entire customer base to one departure.

That the rules are enabled. Most are available and off by default. Check rather than assume.

That one person can sustain it. Anything requiring daily attention fails during leave. Design for weekly and monthly cadences.

That growth will be gradual. The transition from forty to four hundred employees breaks every manual process at once, and it is worth knowing which ones will go first.